Cyber security: the fake "our bank details have changed" email

In September, a Melbourne family business nearly lost $118,000. Scammers got into a genuine email conversation with one of its suppliers and sent a follow-up saying the supplier's bank details had changed. The emails said it was urgent, and the payment was made. Luckily, the business's bank flagged it, a staff member rang the supplier to check, and it was reported straight away. Victoria Police and the AFP were then able to block the funds and return the money. Recovery like this is rare.

Victoria Police says it has received 107 reports of this scam since July. Nationally, this type of scam (called "payment redirection") cost Australians $166.8 million in reported losses in 2025.

What this means for you: three things to do this month

1. Confirm any change of bank details by phone, using a number you already had. Never use a number from the email asking for the change.
2. Turn on multi-factor authentication (a code from your phone as well as a password) for every business email account.
3. Tell whoever pays your bills that urgency is a warning sign. A genuine supplier will never mind you checking.

If money has gone, call your bank immediately. Then report it to police through ReportCyber (cyber.gov.au) and to Scamwatch.

One for larger businesses: if your business turns over $3 million or more a year and pays a ransom after a cyber attack, the law requires you to report the payment to the Australian Signals Directorate within 72 hours.

If any of this affects your business or you'd like to talk it through, contact us through our contact form or give us a call. We're happy to help.